Configure dynamic membership with the memberOf operator

This page's changes and edits · All guidance changes

Microsoft's edit · 17 Mar 16:37 UTC

Editorial pass: dynamic groups articles (33 fixes)

Microsoft's commit message in MicrosoftDocs/entra-docs · commit 79ce023 · +17 ~~−17~~ lines · also on GitHub

⋯ 10 unchanged lines

1111

1212 This feature preview in Microsoft Entra ID enables admins to create dynamic membership groups and administrative units that populate by adding members of other groups using the `memberOf` attribute. Apps that couldn't read group-based membership previously in Microsoft Entra ID can now read the entire membership of these new `memberOf` groups. Not only can these groups be used for apps but they can also be used for licensing assignments.

1313

14 −>[!WARNING]

15 −>This is a preview feature and isn't intended for production use. The use of this feature comes with limitations that can affect dynamic group processing in the tenant. We recommend you review the [Preview limitations](#preview-limitations) section before using this feature.

14 +> [!WARNING]

15 +> This is a preview feature and isn't intended for production use. The use of this feature comes with limitations that can affect dynamic group processing in the tenant. Review the [Preview limitations](#preview-limitations) section before using this feature.

1616

1717 The following diagram illustrates how you could create Dynamic-Group-A with members of Security-Group-X and Security-Group-Y. Members of the groups inside Security-Group-X and Security-Group-Y don't become members of Dynamic-Group-A.

1818

⋯ 8 unchanged lines

2727 ## Preview limitations

2828

2929

30 −- This preview should only be used in test environments as it can affect dynamic group processing in the tenant. We are working on addressing these limitations and will provide updates when they are available.

30 +- This preview should only be used in test environments as it can affect dynamic group processing in the tenant. These limitations are being addressed, and updates will be provided when they're available.

3131 - Each Microsoft Entra tenant is limited to 500 dynamic groups using the `memberOf` attribute. The `memberOf` groups count toward the total dynamic group quota of 15,000.

3232 - Each dynamic group can have up to 50 member groups.

3333 - When you add members of security groups to `memberOf` dynamic membership groups, only direct members of the security group become members of the dynamic group.

⋯ 1 unchanged line

3535 - The `memberOf` attribute can't be used with other rules. For example, a rule that states dynamic group A should contain members of group B and also should contain only users located in Redmond will fail.

3636 - The dynamic group rule builder and validate feature can't be used for `memberOf` at this time.

3737 - The `memberOf` attribute can't be used with other operators. For example, you can't create a rule that states "Members Of group A can't be in Dynamic group B."

38 −- Users included in `memberOf` dynamic membership groups may cause a slower processing time for your tenant, if the tenant has a large number of groups or frequent dynamic membership groups updates.

38 +- Users included in `memberOf` dynamic membership groups might cause a slower processing time for your tenant, if the tenant has a large number of groups or frequent dynamic membership groups updates.

3939 - Membership of a memberOf dynamic group doesn't automatically update when a child group is deleted or when members are removed from a child group. The affected users or devices remain members of the memberOf dynamic group until the rule is modified.

4040

4141

⋯ 12 unchanged lines

5454 1. Example user rule: `user.memberof -any (group.objectId -in ['groupId'])`

5555 1. Example device rule: `device.memberof -any (group.objectId -in ['groupId'])`

5656

57 −> [!NOTE]

58 −> Replace `'groupId'` with the **object ID of the source group** whose members you want to include in the dynamic group.

59 −>

60 −> The two examples are alternatives:

61 −>

62 −> - Use the **user** rule when creating a **Dynamic user** group.

63 −> - Use the **device** rule when creating a **Dynamic device** group.

64 −>

65 −> To include multiple source groups, specify multiple group object IDs. For example:

66 −>

67 −> ```text

68 −> user.memberof -any (group.objectId -in ['<groupObjectId1>', '<groupObjectId2>'])

69 −> ```

57 + > [!NOTE]

58 + > Replace `'groupId'` with the **object ID of the source group** whose members you want to include in the dynamic group.

59 + >

60 + > The two examples are alternatives:

61 + >

62 + > - Use the **user** rule when creating a **Dynamic user** group.

63 + > - Use the **device** rule when creating a **Dynamic device** group.

64 + >

65 + > To include multiple source groups, specify multiple group object IDs. For example:

66 + >

67 + > ```text

68 + > user.memberof -any (group.objectId -in ['<groupObjectId1>', '<groupObjectId2>'])

69 + > ```

7070

7171 1. Select **OK**.

7272 1. Select **Create group**.

Microsoft's Markdown source from MicrosoftDocs/entra-docs, © Microsoft Corporation, under MIT. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy today 06:21 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.